From e9248b8dd0f202499149a25c806a034289b7a21e Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Thu, 1 Oct 2026 15:14:40 +0200 Subject: openvpn: T9370: document the chacha20poly1305 data cipher Add chacha20poly1305 to "encryption data-ciphers" and "encryption data-ciphers-fallback". --- docs/configuration/interfaces/openvpn.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/configuration/interfaces/openvpn.md b/docs/configuration/interfaces/openvpn.md index 170c585d..6f3f145c 100644 --- a/docs/configuration/interfaces/openvpn.md +++ b/docs/configuration/interfaces/openvpn.md @@ -79,7 +79,7 @@ and should be used only in compatibility scenarios. ``` -```{cfgcmd} set interfaces openvpn \ encryption data-ciphers \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | none \> +```{cfgcmd} set interfaces openvpn \ encryption data-ciphers \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | chacha20poly1305 | none \> **Configure a prioritized list of negotiated ciphers for OpenVPN in** ``client`` **or** ``server`` **mode.** @@ -89,13 +89,16 @@ algorithms. It corresponds to OpenVPN’s ``--data-ciphers`` directive and enables cipher negotiation, where both peers automatically agree on a mutually supported cipher during session startup. +`chacha20poly1305` selects ChaCha20-Poly1305, which DCO offloads just like +the AES-GCM ciphers. + :::{note} This option is not compatible with ``site-to-site`` mode. ::: ``` -```{cfgcmd} set interfaces openvpn \ encryption data-ciphers-fallback \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | none \> +```{cfgcmd} set interfaces openvpn \ encryption data-ciphers-fallback \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | chacha20poly1305 | none \> **Configure the fallback cipher for** ``site-to-site`` **mode.** -- cgit v1.2.3